bump

.dockerignore

@@ -0,0 +1,8 @@
+account.sh
+.env
+.git
+.gitignore
+config/
+.vscode/
+Makefile
+README.md

.gitignore

@@ -1,2 +1,3 @@
 config/
 .vscode/
+.env

Dockerfile

@@ -2,10 +2,8 @@
 # adapted from https://github.com/bluesky-social/pds/blob/v0.4.74/Dockerfile
 ################################################################################
 FROM node:20.11-bookworm-slim AS pds-build
-RUN npm install -g pnpm
 
-RUN apt-get update
+RUN npm install -g pnpm && apt-get update && apt-get -y install unzip
-RUN apt-get -y install unzip
 
 # Download and extract the PDS archive
 WORKDIR /app
@@ -21,8 +19,7 @@ RUN pnpm install --prod=true --frozen-lockfile
 ################################################################################
 FROM node:20.11-bookworm-slim AS pds-runtime
 
-RUN apt-get update
+RUN apt-get update && apt-get install -y \
-RUN apt-get install -y \
     dumb-init \
     ca-certificates \
     curl \
@@ -31,7 +28,9 @@ RUN apt-get install -y \
     lsb-release \
     openssl \
     sqlite3 \
+    bsdextrautils \ 
     xxd
+# bsdextrautils for `column` command in the accounts script
 
 WORKDIR /app
 COPY --from=pds-build /app /app
@@ -65,9 +64,8 @@ ENV PDS_CRAWLERS="https://bsky.network"
 
 RUN mv pdsadmin.sh /usr/local/bin/pdsadmin && \
     chmod +x /usr/local/bin/pdsadmin && \
-    mkdir --mode=700 --parent ${PDS_DATADIR}
+    mkdir --mode=700 --parent ${PDS_DATADIR} && \
-
+    rm -rf pds-0.4.74 v0.4.74.zip && \
-RUN rm -rf pds-0.4.74 v0.4.74.zip && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 

Makefile

@@ -2,44 +2,33 @@ REGISTRY=forgejo.gravityfargo.dev
 OWNER=gravityfargo
 IMAGE=bluesky-pds
 TAG=0.4.74
-CONFIG_FILE=config/pds.env
+DOMAIN=sheltersky.social
 
 export DOCKER_BUILDKIT=1
 # export BUILDKIT_PROGRESS=plain
 
-.PHONY: build
+.PHONY: build-tag
-build:
+build-tag:
 	docker build --tag $(REGISTRY)/$(OWNER)/$(IMAGE):$(TAG) .
 
-.PHONY: create-config
+.PHONY: build
-create-config:
+build:
-	@if [ -f $(CONFIG_FILE) ]; then \
+	docker build --no-cache --tag $(REGISTRY)/$(OWNER)/$(IMAGE) .
-		echo "Config already exists. Exiting."; \
-		exit 0; \
-	else \
-		mkdir -p config; \
-		echo "PDS_JWT_SECRET=" >> $(CONFIG_FILE); \
-		echo "PDS_ADMIN_PASSWORD=" >> $(CONFIG_FILE); \
-		echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=" >> $(CONFIG_FILE); \
-		echo "PDS_HOSTNAME=" >> $(CONFIG_FILE); \
-		echo "Done."; \
-		echo "run 'make generate' to generate secrets"; \
-	fi
 
-.PHONY: generate-secrets
+.PHONY: wsdump
-generate-secrets:
+wsdump:
-	@echo "Generating secrets..."
+	wsdump "wss://$(DOMAIN)/xrpc/com.atproto.sync.subscribeRepos?cursor=0"
-	$(eval GENERATE_SECURE_SECRET_CMD=openssl rand --hex 16)
-	$(eval GENERATE_K256_PRIVATE_KEY_CMD=openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)
-	$(eval PDS_ADMIN_PASSWORD=$(shell ${GENERATE_SECURE_SECRET_CMD}))
-	$(eval PDS_JWT_SECRET=$(shell ${GENERATE_SECURE_SECRET_CMD}))
-	$(eval PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(shell ${GENERATE_K256_PRIVATE_KEY_CMD}))
 
-	@sed -i "s/^PDS_ADMIN_PASSWORD=.*/PDS_ADMIN_PASSWORD=${PDS_ADMIN_PASSWORD}/" $(CONFIG_FILE) || echo "PDS_ADMIN_PASSWORD=${PDS_ADMIN_PASSWORD}" >> $(CONFIG_FILE)
+.PHONY: generate-env
-	@sed -i "s/^PDS_JWT_SECRET=.*/PDS_JWT_SECRET=${PDS_JWT_SECRET}/" $(CONFIG_FILE) || echo "PDS_JWT_SECRET=${PDS_JWT_SECRET}" >> $(CONFIG_FILE)
+generate-env:
-	@sed -i "s/^PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=.*/PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=${PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX}/" $(CONFIG_FILE) || echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=${PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX}" >> $(CONFIG_FILE)
+	$(eval PDS_JWT_SECRET=$(shell openssl rand --hex 16))
+	$(eval PDS_ADMIN_PASSWORD=$(shell openssl rand --hex 16))
+	$(eval PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(shell openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32))
 
-	@echo "Done."
+	@echo "PDS_JWT_SECRET=$(PDS_JWT_SECRET)" > .env
+	@echo "PDS_ADMIN_PASSWORD=$(PDS_ADMIN_PASSWORD)" >> .env
+	@echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX)" >> .env
+	@echo "PDS_HOSTNAME=$(DOMAIN)" >> .env
 
 .PHONY: run
 run:

README.md

@@ -1,39 +1,102 @@
 # bluesky-pds-docker
 
-It is required to set the hostname of the container to your FQDN or use host networking on a server whose hostname is the FQDN.
+It is required to run the instance behind a proxy (like traefik) to generate SSL certificates. This will not work otherwise. The standard pds install includes caddy to handle this.
+
+I can confirm it works behind Cloudflare's DNS proxy with Full (strict)
 
 ## Deployment
 
 ```bash
-git clone https://forgejo.gravityfargo.dev/gravityfargo/bluesky-pds-docker.git && cd bluesky-pds-docker
+# Generate secret environment variables
+echo PDS_ADMIN_PASSWORD: $(openssl rand --hex 16)
+echo PDS_JWT_SECRET: $(openssl rand --hex 16)
+echo PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: $(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)
 
-make create-config
+# pull and run the container
-make generate-secrets
+docker pull forgejo.gravityfargo.dev/gravityfargo/bluesky-pds
-# edit the config/pds.env file to set the FQDN
-
-docker pull forgejo.gravityfargo.dev/gravityfargo/bluesky-pds:0.4.74
 docker-compose up -d
+
+# Create an account
+docker exec -it bluesky-pds bash
+pdsadmin account create
+pdsadmin account list
+# pdsadmin request-crawl bsky.network
 ```
+In your browser:
+- Go to https://bsky-debug.app/handle and enter your new user, "HTTP Verification Method" needs to pass.
+- [websocket-tester](https://piehost.com/websocket-tester) "wss://sheltersky.social/xrpc/com.atproto.sync.subscribeRepos?cursor=0" needs to display "Connection Established"
+- https://boat.kelinci.net/ has a helpful tool to export your data.
+- Log in with your new user and go to https://bsky.network/ to see your data.
+
 
 ### Example Docker Compose
 
+Full list of additional Environment Variables can be found in the [packages/pds/src/config/env.ts](https://github.com/bluesky-social/atproto/blob/main/packages/pds/src/config/env.ts)
+```yaml
+services:
+  bluesky-pds:
+    container_name: bluesky-pds
+    image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds
+    environment:
+      PDS_JWT_SECRET: ...
+      PDS_ADMIN_PASSWORD: ...
+      PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ...
+      PDS_HOSTNAME: ...
+    volumes:
+      - ./config:/pds
+```
+
+### Example Docker Compose with Traefik
+
 ```yaml
 services:
   bluesky-pds:
     container_name: bluesky-pds
-    hostname: sheltersky.social
+    image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds:latest
-    image: bluesky-pds:0.4.74
+    networks:
-    ports:
+      - proxy
-      - 3000:3000
+    env_file:
+      PDS_ADMIN_PASSWORD: ""
+      PDS_JWT_SECRET: ""
+      PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: ""
+      PDS_HOSTNAME: example.com
+      PDS_EMAIL_SMTP_URL: smtps://smtp-relay.gmail.com:465/
+      PDS_EMAIL_FROM_ADDRESS: gravityfargo@gmail.com
+
     volumes:
-      - ./config:/pds
+      - /bluesky-pds:/pds
+    labels:
+      traefik.enable: "true"
+      traefik.http.**routers**.bluesky-pds-insecure.entrypoints: http
+      traefik.http.routers.bluesky-pds-insecure.rule: HostRegexp(`^.+\.example\.com$`) || Host(`example.social`)
+      traefik.http.routers.bluesky-pds-secure.entrypoints: https
+      traefik.http.routers.bluesky-pds-secure.rule: HostRegexp(`^.+\.example\.com$`) || Host(`example.social`)
+      traefik.http.routers.bluesky-pds-secure.tls: "true"
+      traefik.http.services.bluesky-pds.loadbalancer.server.scheme: http
+      traefik.http.services.bluesky-pds.loadbalancer.server.port: 3000
+      traefik.http.routers.bluesky-pds-secure.middlewares: BlueskyHeaders@file
+      traefik.http.routers.bluesky-pds-insecure.middlewares: BlueskyHeaders@file
 ```
+#### Middleware
+I think file configs are cleaner than having a billion labels.
+```yaml
+http:
+  middlewares:
+    BlueskyHeaders:
+      headers:
+        accessControlAllowMethods:
+          - GET
+          - OPTIONS
+          - PUT
+          - POST
+          - DELETE
+        accessControlAllowHeaders: "*"
+        accessControlAllowOriginList: "*"
+        addVaryHeader: true
+        stsSeconds: 63072000
+```
+## Development Notes
 
-## Contributing
+```bash
-
+pamac install jq 
-- Fork and clone the repository
+```
-- `make build` to build the image
-
----
-
-It's my preference not to host any code on GitHub, but I've enabled signing in with Github because most people already have that, and I don't want the hassle of a new login to prevent contributors. You cannot create new repositories on this Forgejo instance, but forking is allowed. The upstream PDS repository is on Github.

docker-compose.yaml

@@ -2,8 +2,10 @@ services:
   bluesky-pds-dev:
     container_name: bluesky-pds-dev
     hostname: sheltersky.social
-    image: bluesky-pds:0.4.74
+    image: forgejo.gravityfargo.dev/gravityfargo/bluesky-pds:0.4.74
     ports:
       - 3000:3000
     volumes:
       - ./config:/pds
+    env_file:
+      - .env

entrypoint.sh

@@ -1,24 +1,10 @@
 #!/bin/bash
-LOCAL_IP=$(hostname --all-ip-addresses | awk '{ print $1 }')
 PUBLIC_IP=$(curl https://ipinfo.io/ip --silent)
 HOSTNAME=$(hostname)
+CONFIG_FILE=/pds/pds.env
 
 function main {
 
-    # pds hostname must be the same as the hostname of the container
-    if [[ "${PDS_HOSTNAME}" != "${HOSTNAME}" ]]; then
-        echo "PDS_HOSTNAME must be the same as the hostname of the container"
-        echo "Set the hostname for the container before running."
-        echo "Current hostname: ${HOSTNAME}"
-        echo "PDS_HOSTNAME: ${PDS_HOSTNAME}"
-        exit 1
-    fi
-
-    if [[ -z "${PDS_HOSTNAME}" ]]; then
-        echo "No public DNS address specified"
-        exit 1
-    fi
-
     if [[ -z "${PDS_JWT_SECRET}" ]]; then
         echo "PDS_JWT_SECRET not specified"
         exit 1
@@ -34,19 +20,29 @@ function main {
         exit 1
     fi
 
+    # set PDS_HOSTNAME to hostname if not set
+    if [[ -z "${PDS_HOSTNAME}" ]]; then
+        echo "PDS_HOSTNAME not specified"
+        exit 1
+    fi
+
+    # create the config if it does not exist
+    if [[ ! -f ${CONFIG_FILE} ]]; then
+        echo "PDS_JWT_SECRET=${PDS_JWT_SECRET}" >${CONFIG_FILE}
+        echo "PDS_ADMIN_PASSWORD=${PDS_ADMIN_PASSWORD}" >>${CONFIG_FILE}
+        echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=${PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX}" >>${CONFIG_FILE}
+        echo "PDS_HOSTNAME=${PDS_HOSTNAME}" >>${CONFIG_FILE}
+        echo "PDS_CRAWLERS=https://bsky.network" >>${CONFIG_FILE}
+    fi
+
     cat <<STARTED_MESSAGE
 ========================================================================
 PDS Started
 ------------------------------------------------------------------------
 
-Hostname                  : ${PDS_HOSTNAME}
+HOSTNAME: ${HOSTNAME}
-                          : http://${PDS_HOSTNAME}:3000/xrpc/_health
+PUBLIC_IP: ${PUBLIC_IP}
-
+PDS_HOSTNAME: ${PDS_HOSTNAME}
-Local IP                  : ${LOCAL_IP}
-                          : http://${LOCAL_IP}:3000/xrpc/_health
-
-Public IP                 : ${PUBLIC_IP}
-                          : http://${PUBLIC_IP}:3000/xrpc/_health
 
 ========================================================================
 STARTED_MESSAGE